INSeRT: Protect Dynamic Code Generation against spraying

DCG (Dynamic Code Generation) technologies have found widely applications in the Web 2.0 era, and DCG-Spraying attack can easily circumvent DEP and ASLR protection mechanisms built in modern operating systems. We propose a new protection method, INSeRT, which combines randomization of intrinsic elements of machine instructions and randomly planted special trapping snippets. INSeRT practically renders the “sprayed code” ineffective, while alerts the host program of ongoing attacking attempts. We implemented a prototype of INSeRT on the V8 JavaScript engine with a performance overhead of less than 5%, which should be acceptable in practical application.